Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passkeys: The beginning of the end of the password

blog.google

Post reply on HN
Print view View original

481–490 of 1001 posts

Re: Passkeys: The beginning of the end of the password

#481

Post by GivinStatic »

jacquesm wrote: post #480

This is just a way to tie your identity more closely to your account, it doesn't make anything more or less secure. Every big silo is trying to do this constantly and once you recognize the pattern you'll see it everywhere. Never mind the inconvenience to the users, all that matters is that you are known to the system wherever you are and on whatever device you are using so that your profile can be closely matched to…

My thoughts exactly. In the post linked and in the post explaining how passkey works they mention that none of biometric data is sent to google. The catch? More precise data about your devices and subsequently about you.

Re: Passkeys: The beginning of the end of the password

#482

Post by wkat4242 »

danShumway wrote: post #398
lxgr wrote: post #241

Earlier quoted context omitted.

> I wonder if there's a fully self hosted passkeys option? If external authenticators work for you, physical keys (like Yubikey, Solokey etc.) are arguably self-hosted! For on-device passkeys, at least Android is preparing an API for this [1]. I hope that iOS will follow at some point, as well as Firefox (which unfortunately has been quite slow to adopt all aspects of WebAuthN). > I'm also opposed to attestation. Wit…

> In principle I agree, but some service providers like banks are legally liable for fraud losses (at least in some jurisdictions). I'd say they do have a legitimate interest of being able to verify which authenticators they trust. I have yet to see a bank use login restrictions to make itself more secure. I've been trying to get my bank to offer actual 2FA for years, and their response is that they moved from offeri…

> Their authenticator apps that they do have are terrible and my security would be improved if I could just use a simple 2FA app.

Good point. I was at my bank last year to discuss a mortgage. It's already a bank I don't feel so good about because their idea of "authentication" is to type a 2FA code that you get from the bank app into the bank app (so you have to type the code in the same app that just gave the code to you!). This really feels like busywork rather than real security.

But anyway was she sat down I saw her log in from a Windows 10 endpoint into a VDI system that was clearly Windows XP (or 2k3 server) judging by the login screen and window decorations. Sigh... I have serious reservations now about leaving my money there.

Of course VDIs are sometimes considered more secure but at my work we have really come back from that idea. Back when wannacry hit on a friday afternoon most laptops had already left the office for people's homes. But the VDI servers were online 24/7 and constantly kept getting re-infected and spreading malware throughout the network.

> And there's nothing official to discourage companies from using attestation other than some vague "but don't do this if you don't need to" language. It's a bad idea that will be used to restrict people's control over their own devices that they own.

Totally agreed, this is also the problem I have with attestation.

Re: Passkeys: The beginning of the end of the password

#483

Post by OptionX »

jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

For a technical standpoint it's a system that generates OTPs from another Auth source, like biometrics or even a classical password.

From a practical one it's another way to get people to relly on major comporations for all Auth ises so they yet have another thing anchoring to their ecosystem.

Re: Passkeys: The beginning of the end of the password

#484

Post by prmoustache »

stanislavb wrote: post #418
jimmar wrote: post #294

The paragraph in the section, "What are passkeys?" tells me that they: are new, are easier, let me use biometrics, and are resistant to attacks. But, it doesn't tell me what passkeys actually are. Compare passkeys to traditional authentication factors. What's a password? A secret word or phrase that only you know. What are biometrics? Parts of your body that can help uniquely identify you, like your fingerprint or re…

If people here can't understand what passkeys are, how are the "normies" gona get it? Or maybe the wide public is not supposed to get it how it works; they should "simply" use it.

They will understand their password has been replaced by fingerprint reading or pin on their smartphone. They won't bother with the technical aspects behind it.

And they will be fine with that because they have already been introduced to this because that is the way they authenticate locally with many apps on their smartphone already.

Re: Passkeys: The beginning of the end of the password

#485

Post by prmoustache »

augusto-moura wrote: post #356
Dalewyn wrote: post #312

Earlier quoted context omitted.

Passwords will never be supplanted unless the new challenger can satisfy all of the following: * Easy to understand. (A password is just a word/phrase/string of characters only you know.) * Easy to use. (Using a password only requires remembering and typing it in when prompted.) * Convenient. (Only your ability to remember and type required. No other tools or gadgets required.) * Simple. (All of the above.) If someth…

I'm not sure if it is passkeys or other mechanism, but I can easily open my bank account on my Android phone just by using biometrics. Instead of typing a pin or password I just do the biometrics and voilá, it opens like magic. That really made me appreciate passwordless apps. On the other hand, I don't really know how would that work on desktops, should chrome use a Windows service for that? Would it use its own ser…

I guess the idea is they will ask you to grab your smartphone the same way they do it for 2FA. For the end user it will be just like using the 2nd factor of authentication without the primary one (login + password).

Re: Passkeys: The beginning of the end of the password

#486

Post by mk89 »

mastazi wrote: post #386
mk89 wrote: post #357

Earlier quoted context omitted.

You need to click on the link that is in the post: https://blog.google/technology/safety-security/one-step-clos... > Instead, your phone will store a FIDO credential called a passkey which is used to unlock your online account. The passkey makes signing in far more secure, as it’s based on public key cryptography and is only shown to your online account when you unlock your phone. It looks like a token stored on your…

So it's like a private key but you can't access or manage it, as it's owned by Google/Apple/Microsoft? How convenient!

No, hold on. That's not what I implied.

My understanding is that the private key is stored on your own device, unless you decide to use something like iCloud Keychain (which should be encrypted).

The public key, on the other hand, is stored on the service providers' servers. That is used to create a "challenge", which I guess on your phone you will need to "decrypt/sign" with the private key to prove that "it's really you".

That's how I understand it.

Re: Passkeys: The beginning of the end of the password

#487

Post by alpos »

Just here to note that there are several huge problems with this approach from an actual security standpoint:

First is that this changes from 2-factor authentication (something you have plus something you know) to single-factor (just something you have).

Also be sure to notice in the article that they have changed their term there to 2-STEP authentication, not 2-FACTOR authentication, these are not the same thing, and they know that. It's important that you know the difference too if you want any kind of real security. If you use passkeys plus an authentication code app, then you have 2-steps (for whatever that's worth) but not 2-factors since they are both just a piece of code on your device, if they are both on the same device, that's even less secure since they can both be compromised at the same time, and in practice they will be.

Second is that the now single factor authenticator is strictly worse than a password because it is something that can be taken away from you and manipulated without your permission.

Third is that the keys are not private since the passkey provider is storing them for you and/or copying them around. This means they can be spied on, stolen, or demanded by the government, all without you even knowing someone else got access to your stuff.

The last glaring issue I can see for the time being is that it relies on a simple, easily cracked unlock pin, or worse still fingerprint/facial recognition bio-metrics as the only way to keep someone, other than Google, out.

One might be tempted to think facial recognition or fingerprints are pretty good security but it's already been demonstrated that people can break those mechanisms quickly and the cops can and will use your fingerprint and/or mug shot to unlock your phone if it's locked by biometrics only. They are not allowed to force you to give your real password, but the courts do allow them to use any means they like to break into your phone. Even if they damage it in the process, they just have to pay you back for it, they still get to take your data and use it against you.

Just some things to keep in mind before anyone gets too excited about this "new" invention. There's a reason we still have passwords even though we've had Smart ID Cards (such as DoD's CAC system https://www.cac.mil/) and other device driven access controls for decades now.

Re: Passkeys: The beginning of the end of the password

#488

Post by gnufx »

Regarding the statements that you need a Yubikey (for the FIDO part of passkey, given application support?) on GNU/Linux, at least Solo 2, Nitrokey 3, and Onlykey hardware keys have free firmware. I can't vouch for them, but maybe also see https://github.com/psanford/tpm-fido and https://github.com/bulwarkid/virtual-fido

Re: Passkeys: The beginning of the end of the password

#489

Post by masukomi »

__MatrixMan__ wrote: post #370
mk89 wrote: post #357

Earlier quoted context omitted.

You need to click on the link that is in the post: https://blog.google/technology/safety-security/one-step-clos... > Instead, your phone will store a FIDO credential called a passkey which is used to unlock your online account. The passkey makes signing in far more secure, as it’s based on public key cryptography and is only shown to your online account when you unlock your phone. It looks like a token stored on your…

Why not call it a private key then, we've been handling those since the 70's. They don't need to be rebranded, they need to be taught in high school with the same words we've always used to talk about them.

because there's a time based hardware component to it.

this isn't just public key encryption. Think of it as a physical Yubikey but embedded in your ...whatever.

Re: Passkeys: The beginning of the end of the password

#490

Post by jillesvangurp »

lxgr wrote: post #241
wkat4242 wrote: post #185

Earlier quoted context omitted.

Personally I don't want to be dependent on a third party like Google or Apple for my identity. That's never going to be acceptable. If they just accept normal Yubikeys (and multiple at a time for redundancy) that'd work for me but this passkey stuff where the vendor gets to decide things and I don't fully own my credentials is just wrong IMO. I wonder if there's a fully self hosted passkeys option? I'm also opposed t…

> I wonder if there's a fully self hosted passkeys option? If external authenticators work for you, physical keys (like Yubikey, Solokey etc.) are arguably self-hosted! For on-device passkeys, at least Android is preparing an API for this [1]. I hope that iOS will follow at some point, as well as Firefox (which unfortunately has been quite slow to adopt all aspects of WebAuthN). > I'm also opposed to attestation. Wit…

https://connect.mozilla.org/t5/ideas/support-webauthn-passke...

This page has a recent comment from a Mozilla employee on Firefox support:

04-24-2023 04:39 AM

    We are actively working on supporting this feature.

    Here is our current roadmap (might change):

    - WebAuthn Level 1 + CTAP2 is riding the trains for Fx 114
    - WebAuthn Level 2 + 3 are planned to ride the Fx 116 train
    - Passkeys (though details are still about to figured out) earliest completion is Fx 120
So, it's coming but it's going to take at least six months or so. Current beta version is 113.
Post reply on HN